Verification of Behavior Trees with Contingency Monitors

Serena S. Serbinowska,Nicholas Potteiger,Anne M. Tumlin,Taylor T. Johnson
DOI: https://doi.org/10.4204/EPTCS.411.4
2024-11-21
Abstract:Behavior Trees (BTs) are high level controllers that have found use in a wide range of robotics tasks. As they grow in popularity and usage, it is crucial to ensure that the appropriate tools and methods are available for ensuring they work as intended. To that end, we created a new methodology by which to create Runtime Monitors for BTs. These monitors can be used by the BT to correct when undesirable behavior is detected and are capable of handling LTL specifications. We demonstrate that in terms of runtime, the generated monitors are on par with monitors generated by existing tools and highlight certain features that make our method more desirable in various situations. We note that our method allows for our monitors to be swapped out with alternate monitors with fairly minimal user effort. Finally, our method ties in with our existing tool, BehaVerify, allowing for the verification of BTs with monitors.
Robotics
What problem does this paper attempt to address?
### What problems does this paper attempt to solve? This paper aims to solve the problems of correctness and reliability of Behavior Trees (BTs) in practical applications. Specifically, the authors propose a new method to create Runtime Monitors for BTs to ensure that BTs can work as expected during their operation and can self - correct when unexpected behaviors are detected. #### Main problem description 1. **Ensuring the correctness of BTs**: - With the wide application of BTs in fields such as robot and drone control, especially in safety - critical areas, ensuring the correctness of these controllers has become crucial. - The paper points out that although existing tools can generate runtime monitors, they are not specifically designed for BTs, so they may not be well - integrated with BTs or respond inappropriately. 2. **Achieving runtime monitoring and design - time verification**: - **Runtime monitoring**: It can detect potential problems in real - time during the BT operation and allow the BT to self - correct according to the monitoring results. - **Design - time verification**: It can ensure that the BT model is correct at the design stage, thereby reducing the possibility of problems occurring at runtime. 3. **Improving the performance and flexibility of monitors**: - The authors not only focus on the functionality of monitors but also emphasize their performance and flexibility. They show through experiments that the generated monitors are comparable in performance to existing tools and have advantages in some cases. - In addition, their method allows users to easily replace different monitors without a large amount of code modification. #### Solution overview - **Formal definition of BTs and monitors (BTMs)**: - Propose a formal definition of BTMs, incorporating the state and behavior of monitors into the overall framework of BTs. - **Extension of BehaVerify DSL**: - Extend the domain - specific language (DSL) of BehaVerify so that it can describe BTs with monitors (BTMs). - **Process of generating monitors**: - Use the LTL2BA tool to convert Linear Temporal Logic (LTL) specifications into Büchi automata (BA), and then translate them into Python or C code for use in actual systems. - At the same time, the generated monitors can also be used for nuXmv model checking to verify the design - time correctness of BTMs. #### Experiments and comparisons - **Performance comparison**: - Experiments were carried out through two extended scenarios (grid navigation tasks of different scales) to compare the performance of monitors generated by BehaVerify with those generated by NASA Copilot. - The results show that the monitors generated by BehaVerify are not inferior in performance to existing tools and are better in some cases. - **Demonstration of flexibility**: - The flexibility and effectiveness of the monitors are demonstrated by generating example trajectories, proving their potential in practical applications. In summary, the main objective of this paper is to provide a reliable method to ensure the correctness of BTs at runtime and design - time, and the effectiveness and superiority of this method are verified through experiments.